Privacy policy clauses for Drizzle ORM
Drizzle ORM is a lightweight TypeScript object-relational mapping library that allows developers to interact with databases using SQL-like syntax. Websites use Drizzle ORM to manage database queries and operations while maintaining type safety and reducing boilerplate code.
Free scan · No signup · Results in 60 seconds
What data Drizzle ORM collects
Your privacy policy must disclose each of the following data types when you use Drizzle ORM.
When does Drizzle ORM trigger privacy obligations?
Drizzle ORM itself does not collect data—it is a query builder and schema mapper. However, privacy obligations trigger the moment you define a schema with PII fields and connect Drizzle to a database that stores user data.
### Data Flow That Triggers Obligations
When you use Drizzle to persist personally identifiable information (names, emails, IP addresses, payment details, phone numbers), you become a data controller under GDPR Article 4(7) and a business under CCPA Section 1798.100. The ORM itself is neutral—your schema determines what you're storing.
### Jurisdiction-Specific Thresholds
GDPR (EU/EEA users): Applies immediately if any user is located in the EU, regardless of your company's location. No data volume threshold.
CCPA (California users): Applies if you collect personal information from California residents and meet one of three thresholds: annual revenue >$25M, data on 100,000+ consumers/households, or data sales >25% of revenue (CCPA Section 1798.100).
UK GDPR: Mirrors GDPR for UK residents; separate legal basis required.
### First Concrete Step
